#43614 [Opn]: incorrect processing of numerical string keys of array (unserialize)

ID: 43614 Updated by: felipe@php.net Reported By: dmitriy dot buldakov at toatech dot com Status: Open Bug Type: Arrays related Operating System: Mac OS X PHP Version: 5.2.5 New Comment: Updated. The function did accept other characters. And how not is possible to use de HANDLE_NUMERIC(), I make a loop and check for each char. http://ecl.zoone.com.br/etc/patches/bug43614.patch Previous Comments: ------------------------------------------------------------------------ [2007-12-17 16:03:08] dmitriy dot buldakov at toatech dot com Last patch works much more better, but there is still a problem. the patch ignores leading spaces. for example keys ' 10' and ' -10' are converted to integer 10 and -10. ------------------------------------------------------------------------ [2007-12-17 13:54:07] felipe@php.net Yes, correct. I've used not suitable function. Tony alerted me of a correct function. http://ecl.zoone.com.br/etc/patches/bug43614.patch http://ecl.zoone.com.br/etc/patches/bug43614.phpt ------------------------------------------------------------------------ [2007-12-17 13:38:13] dmitriy dot buldakov at toatech dot com Looks like the simple solution is not very good. As far as I understood the patch just convert any numeric string to long. It is not right way because: 1) it dose not make range check ("9999999999" is converted to 2147483647) 2) it dose not recognize negative values ("-10" is not converted to string) 3) it ignores leading zero ("01" to 1) For example, the reproduce code result is still not expected: 1 Array ( [10] => 3 [1] => 2 [01] => 4 ) KEY: int(10) VAL: int(3) KEY: int(1) VAL: int(2) KEY: string(2) "01" VAL: int(4) ------------------------------------------------------------------------ [2007-12-17 12:00:02] felipe@php.net Hmm, ok, arbitray string... Simple solution: Index: var_unserializer.c =================================================================== RCS file: /repository/php-src/ext/standard/var_unserializer.c,v retrieving revision 1.70.2.4.2.7.2.3 diff -u -u -r1.70.2.4.2.7.2.3 var_unserializer.c --- var_unserializer.c 17 Oct 2007 10:36:33 -0000 1.70.2.4.2.7.2.3 +++ var_unserializer.c 17 Dec 2007 11:58:43 -0000 @@ -282,6 +282,10 @@ return 0; } + if (Z_TYPE_P(key) == IS_STRING && strspn(Z_STRVAL_P(key), "0123456789") == Z_STRLEN_P(key)) { + convert_to_long(key); + } + switch (Z_TYPE_P(key)) { case IS_LONG: if (zend_hash_index_find(ht, Z_LVAL_P(key), (void **)&old_data)==SUCCESS) { ------------------------------------------------------------------------ [2007-12-17 08:24:21] dmitriy dot buldakov at toatech dot com The bug also can be reproduced under FreeBSD 6.2 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/43614 -- Edit this bug report at http://bugs.php.net/?id=43614&edit=1